ddtrace 1.12.1 → 1.23.2

data/lib/datadog/appsec/contrib/rails/patcher.rb

@@ -33,19 +33,19 @@ module Datadog
 
           def patch
             Gateway::Watcher.watch
-            patch_before_intialize
-            patch_after_intialize
+            patch_before_initialize
+            patch_after_initialize
 
             Patcher.instance_variable_set(:@patched, true)
           end
 
-          def patch_before_intialize
+          def patch_before_initialize
             ::ActiveSupport.on_load(:before_initialize) do
-              Datadog::AppSec::Contrib::Rails::Patcher.before_intialize(self)
+              Datadog::AppSec::Contrib::Rails::Patcher.before_initialize(self)
             end
           end
 
-          def before_intialize(app)
+          def before_initialize(app)
             BEFORE_INITIALIZE_ONLY_ONCE_PER_APP[app].run do
               # Middleware must be added before the application is initialized.
               # Otherwise the middleware stack will be frozen.
@@ -83,9 +83,15 @@ module Datadog
                 super
               end
 
-              if request_response && request_response.any? { |action, _event| action == :block }
-                @_response = AppSec::Response.negotiate(env).to_action_dispatch_response
-                request_return = @_response.body
+              if request_response
+                blocked_event = request_response.find { |action, _options| action == :block }
+                if blocked_event
+                  @_response = AppSec::Response.negotiate(
+                    env,
+                    blocked_event.last[:actions]
+                  ).to_action_dispatch_response
+                  request_return = @_response.body
+                end
               end
 
               request_return
@@ -134,13 +140,13 @@ module Datadog
             Datadog.logger.debug { 'Rails middlewares: ' << app.middleware.map(&:inspect).inspect }
           end
 
-          def patch_after_intialize
+          def patch_after_initialize
             ::ActiveSupport.on_load(:after_initialize) do
-              Datadog::AppSec::Contrib::Rails::Patcher.after_intialize(self)
+              Datadog::AppSec::Contrib::Rails::Patcher.after_initialize(self)
             end
           end
 
-          def after_intialize(app)
+          def after_initialize(app)
             AFTER_INITIALIZE_ONLY_ONCE_PER_APP[app].run do
               # Finish configuring the tracer after the application is initialized.
               # We need to wait for some things, like application name, middleware stack, etc.

data/lib/datadog/appsec/contrib/rails/reactive/action.rb

@@ -36,7 +36,7 @@ module Datadog
                   'server.request.path_params' => path_params,
                 }
 
-                waf_timeout = Datadog::AppSec.settings.waf_timeout
+                waf_timeout = Datadog.configuration.appsec.waf_timeout
                 result = waf_context.run(waf_args, waf_timeout)
 
                 Datadog.logger.debug { "WAF TIMEOUT: #{result.inspect}" } if result.timeout
@@ -45,11 +45,8 @@ module Datadog
                 when :match
                   Datadog.logger.debug { "WAF: #{result.inspect}" }
 
-                  block = result.actions.include?('block')
-
-                  yield [result, block]
-
-                  throw(:block, [result, true]) if block
+                  yield result
+                  throw(:block, true) unless result.actions.empty?
                 when :ok
                   Datadog.logger.debug { "WAF OK: #{result.inspect}" }
                 when :invalid_call

data/lib/datadog/appsec/contrib/sinatra/ext.rb

@@ -1,10 +1,11 @@
+# frozen_string_literal: true
+
 module Datadog
   module AppSec
     module Contrib
       module Sinatra
         # Sinatra integration constants
         module Ext
-          APP = 'sinatra'.freeze
           ROUTE_INTERRUPT = :datadog_appsec_contrib_sinatra_route_interrupt
         end
       end

data/lib/datadog/appsec/contrib/sinatra/framework.rb

@@ -11,9 +11,7 @@ module Datadog
         module Framework
           # Configure Rack from Sinatra, but only if Rack has not been configured manually beforehand
           def self.setup
-            Datadog::AppSec.configure do |datadog_config|
-              datadog_config.instrument(:rack)
-            end
+            Datadog.configuration.appsec.instrument(:rack)
           end
         end
       end

data/lib/datadog/appsec/contrib/sinatra/gateway/watcher.rb

@@ -22,11 +22,12 @@ module Datadog
               def watch_request_dispatch(gateway = Instrumentation.gateway)
                 gateway.watch('sinatra.request.dispatch', :appsec) do |stack, gateway_request|
                   block = false
+
                   event = nil
                   scope = gateway_request.env[Datadog::AppSec::Ext::SCOPE_KEY]
 
                   AppSec::Reactive::Operation.new('sinatra.request.dispatch') do |op|
-                    Rack::Reactive::RequestBody.subscribe(op, scope.processor_context) do |result, _block|
+                    Rack::Reactive::RequestBody.subscribe(op, scope.processor_context) do |result|
                       if result.status == :match
                         # TODO: should this hash be an Event instance instead?
                         event = {
@@ -46,7 +47,7 @@ module Datadog
                       end
                     end
 
-                    _result, block = Rack::Reactive::RequestBody.publish(op, gateway_request)
+                    block = Rack::Reactive::RequestBody.publish(op, gateway_request)
                   end
 
                   next [nil, [[:block, event]]] if block
@@ -65,11 +66,12 @@ module Datadog
               def watch_request_routed(gateway = Instrumentation.gateway)
                 gateway.watch('sinatra.request.routed', :appsec) do |stack, (gateway_request, gateway_route_params)|
                   block = false
+
                   event = nil
                   scope = gateway_request.env[Datadog::AppSec::Ext::SCOPE_KEY]
 
                   AppSec::Reactive::Operation.new('sinatra.request.routed') do |op|
-                    Sinatra::Reactive::Routed.subscribe(op, scope.processor_context) do |result, _block|
+                    Sinatra::Reactive::Routed.subscribe(op, scope.processor_context) do |result|
                       if result.status == :match
                         # TODO: should this hash be an Event instance instead?
                         event = {
@@ -89,7 +91,7 @@ module Datadog
                       end
                     end
 
-                    _result, block = Sinatra::Reactive::Routed.publish(op, [gateway_request, gateway_route_params])
+                    block = Sinatra::Reactive::Routed.publish(op, [gateway_request, gateway_route_params])
                   end
 
                   next [nil, [[:block, event]]] if block

data/lib/datadog/appsec/contrib/sinatra/patcher.rb

@@ -65,9 +65,12 @@ module Datadog
               catch(Datadog::AppSec::Contrib::Sinatra::Ext::ROUTE_INTERRUPT) { super }
             end
 
-            if request_response && request_response.any? { |action, _event| action == :block }
-              self.response = AppSec::Response.negotiate(env).to_sinatra_response
-              request_return = nil
+            if request_response
+              blocked_event = request_response.find { |action, _options| action == :block }
+              if blocked_event
+                self.response = AppSec::Response.negotiate(env, blocked_event.last[:actions]).to_sinatra_response
+                request_return = nil
+              end
             end
 
             request_return
@@ -103,11 +106,14 @@ module Datadog
                 [gateway_request, gateway_route_params]
               )
 
-              if request_response && request_response.any? { |action, _event| action == :block }
-                self.response = AppSec::Response.negotiate(env).to_sinatra_response
+              if request_response
+                blocked_event = request_response.find { |action, _options| action == :block }
+                if blocked_event
+                  self.response = AppSec::Response.negotiate(env, blocked_event.last[:actions]).to_sinatra_response
 
-                # interrupt request and return response to dispatch! for consistency
-                throw(Datadog::AppSec::Contrib::Sinatra::Ext::ROUTE_INTERRUPT, response)
+                  # interrupt request and return response to dispatch! for consistency
+                  throw(Datadog::AppSec::Contrib::Sinatra::Ext::ROUTE_INTERRUPT, response)
+                end
               end
 
               yield(*args)

data/lib/datadog/appsec/contrib/sinatra/reactive/routed.rb

@@ -31,7 +31,7 @@ module Datadog
                   'server.request.path_params' => path_params,
                 }
 
-                waf_timeout = Datadog::AppSec.settings.waf_timeout
+                waf_timeout = Datadog.configuration.appsec.waf_timeout
                 result = waf_context.run(waf_args, waf_timeout)
 
                 Datadog.logger.debug { "WAF TIMEOUT: #{result.inspect}" } if result.timeout
@@ -40,11 +40,8 @@ module Datadog
                 when :match
                   Datadog.logger.debug { "WAF: #{result.inspect}" }
 
-                  block = result.actions.include?('block')
-
-                  yield [result, block]
-
-                  throw(:block, [result, true]) if block
+                  yield result
+                  throw(:block, true) unless result.actions.empty?
                 when :ok
                   Datadog.logger.debug { "WAF OK: #{result.inspect}" }
                 when :invalid_call

data/lib/datadog/appsec/event.rb

@@ -1,4 +1,6 @@
 require 'json'
+require 'zlib'
+require 'base64'
 
 require_relative 'rate_limiter'
 
@@ -34,78 +36,132 @@ module Datadog
         Content-Language
       ].map!(&:downcase).freeze
 
+      MAX_ENCODED_SCHEMA_SIZE = 25000
+      # For more information about this number
+      # please check https://github.com/DataDog/dd-trace-rb/pull/3177#issuecomment-1747221082
+      MIN_SCHEMA_SIZE_FOR_COMPRESSION = 260
+
       # Record events for a trace
       #
       # This is expected to be called only once per trace for the rate limiter
       # to properly apply
-      def self.record(span, *events)
-        # ensure rate limiter is called only when there are events to record
-        return if events.empty?
+      class << self
+        def record(span, *events)
+          # ensure rate limiter is called only when there are events to record
+          return if events.empty? || span.nil?
 
-        Datadog::AppSec::RateLimiter.limit(:traces) do
-          record_via_span(span, *events)
+          Datadog::AppSec::RateLimiter.limit(:traces) do
+            record_via_span(span, *events)
+          end
         end
-      end
 
-      def self.record_via_span(span, *events)
-        events.group_by { |e| e[:trace] }.each do |trace, event_group|
-          unless trace
-            Datadog.logger.debug { "{ error: 'no trace: cannot record', event_group: #{event_group.inspect}}" }
-            next
-          end
+        def record_via_span(span, *events)
+          events.group_by { |e| e[:trace] }.each do |trace, event_group|
+            unless trace
+              Datadog.logger.debug { "{ error: 'no trace: cannot record', event_group: #{event_group.inspect}}" }
+              next
+            end
+
+            trace.keep!
+            trace.set_tag(
+              Datadog::Tracing::Metadata::Ext::Distributed::TAG_DECISION_MAKER,
+              Datadog::Tracing::Sampling::Ext::Decision::ASM
+            )
 
-          trace.keep!
-          trace.set_tag(
-            Datadog::Tracing::Metadata::Ext::Distributed::TAG_DECISION_MAKER,
-            Datadog::Tracing::Sampling::Ext::Decision::ASM
-          )
-
-          # prepare and gather tags to apply
-          service_entry_tags = build_service_entry_tags(event_group)
-          # complex types are unsupported, we need to serialize to a string
-          triggers = service_entry_tags.delete('_dd.appsec.triggers')
-          span.set_tag('_dd.appsec.json', JSON.dump({ triggers: triggers }))
-
-          # apply tags to service entry span
-          service_entry_tags.each do |key, value|
-            span.set_tag(key, value)
+            # prepare and gather tags to apply
+            service_entry_tags = build_service_entry_tags(event_group)
+
+            # apply tags to service entry span
+            service_entry_tags.each do |key, value|
+              span.set_tag(key, value)
+            end
           end
         end
-      end
 
-      def self.build_service_entry_tags(event_group)
-        event_group.each_with_object({}) do |event, tags|
-          # TODO: assume HTTP request context for now
+        # rubocop:disable Metrics/MethodLength
+        def build_service_entry_tags(event_group)
+          waf_events = []
+          entry_tags = event_group.each_with_object({ '_dd.origin' => 'appsec' }) do |event, tags|
+            # TODO: assume HTTP request context for now
+            if (request = event[:request])
+              request.headers.each do |header, value|
+                tags["http.request.headers.#{header}"] = value if ALLOWED_REQUEST_HEADERS.include?(header.downcase)
+              end
+
+              tags['http.host'] = request.host
+              tags['http.useragent'] = request.user_agent
+              tags['network.client.ip'] = request.remote_addr
+            end
 
-          if (request = event[:request])
-            request_headers = request.headers.select do |k, _|
-              ALLOWED_REQUEST_HEADERS.include?(k.downcase)
+            if (response = event[:response])
+              response.headers.each do |header, value|
+                tags["http.response.headers.#{header}"] = value if ALLOWED_RESPONSE_HEADERS.include?(header.downcase)
+              end
             end
 
-            request_headers.each do |header, value|
-              tags["http.request.headers.#{header}"] = value
+            waf_result = event[:waf_result]
+            # accumulate triggers
+            waf_events += waf_result.events
+
+            waf_result.derivatives.each do |key, value|
+              parsed_value = json_parse(value)
+              next unless parsed_value
+
+              parsed_value_size = parsed_value.size
+
+              schema_value = if parsed_value_size >= MIN_SCHEMA_SIZE_FOR_COMPRESSION
+                               compressed_and_base64_encoded(parsed_value)
+                             else
+                               parsed_value
+                             end
+              next unless schema_value
+
+              if schema_value.size >= MAX_ENCODED_SCHEMA_SIZE
+                Datadog.logger.debug do
+                  "Schema key: #{key} exceeds the max size value. It will not be included as part of the span tags"
+                end
+                next
+              end
+
+              tags[key] = schema_value
             end
 
-            tags['http.host'] = request.host
-            tags['http.useragent'] = request.user_agent
-            tags['network.client.ip'] = request.remote_addr
+            tags
           end
 
-          if (response = event[:response])
-            response_headers = response.headers.select do |k, _|
-              ALLOWED_RESPONSE_HEADERS.include?(k.downcase)
-            end
+          appsec_events = json_parse({ triggers: waf_events })
+          entry_tags['_dd.appsec.json'] = appsec_events if appsec_events
+          entry_tags
+        end
+        # rubocop:enable Metrics/MethodLength
 
-            response_headers.each do |header, value|
-              tags["http.response.headers.#{header}"] = value
-            end
+        private
+
+        def compressed_and_base64_encoded(value)
+          Base64.strict_encode64(gzip(value))
+        rescue TypeError => e
+          Datadog.logger.debug do
+            "Failed to compress and encode value when populating AppSec::Event. Error: #{e.message}"
           end
+          nil
+        end
 
-          tags['_dd.origin'] = 'appsec'
+        def json_parse(value)
+          JSON.dump(value)
+        rescue ArgumentError => e
+          Datadog.logger.debug do
+            "Failed to parse value to JSON when populating AppSec::Event. Error: #{e.message}"
+          end
+          nil
+        end
 
-          # accumulate triggers
-          tags['_dd.appsec.triggers'] ||= []
-          tags['_dd.appsec.triggers'] += event[:waf_result].data
+        def gzip(value)
+          sio = StringIO.new
+          # For an in depth comparison of Zlib options check https://github.com/DataDog/dd-trace-rb/pull/3177#issuecomment-1747215473
+          gz = Zlib::GzipWriter.new(sio, Zlib::BEST_SPEED, Zlib::DEFAULT_STRATEGY)
+          gz.write(value)
+          gz.close
+          sio.string
         end
       end
     end

data/lib/datadog/appsec/extensions.rb

@@ -8,136 +8,7 @@ module Datadog
     module Extensions
       # Inject AppSec into global objects.
       def self.activate!
-        Core::Configuration::Settings.include(Settings)
-      end
-
-      # Global Datadog configuration mixin
-      module Settings
-        # Exposes AppSec settings through the
-        # `Datadog.configure {|c| c.appsec._option_ }`
-        # configuration path.
-        def appsec
-          @appsec ||= AppSecAdapter.new(AppSec.settings)
-        end
-      end
-
-      # Merges {Datadog::AppSec::Configuration::Settings} and {Datadog::AppSec::Configuration::DSL}
-      # into a single read/write object.
-      class AppSecAdapter
-        def initialize(settings)
-          @settings = settings
-        end
-
-        # Writer methods
-
-        def instrument(name, _unused = {})
-          dsl = AppSec::Configuration::DSL.new
-          dsl.instrument(name)
-          @settings.merge(dsl)
-        end
-
-        def enabled=(arg)
-          dsl = AppSec::Configuration::DSL.new
-          dsl.enabled = arg
-          @settings.merge(dsl)
-        end
-
-        def ruleset=(arg)
-          dsl = AppSec::Configuration::DSL.new
-          dsl.ruleset = arg
-          @settings.merge(dsl)
-        end
-
-        def ip_denylist=(arg)
-          dsl = AppSec::Configuration::DSL.new
-          dsl.ip_denylist = arg
-          @settings.merge(dsl)
-        end
-
-        def user_id_denylist=(arg)
-          dsl = AppSec::Configuration::DSL.new
-          dsl.user_id_denylist = arg
-          @settings.merge(dsl)
-        end
-
-        def waf_timeout=(arg)
-          dsl = AppSec::Configuration::DSL.new
-          dsl.waf_timeout = arg
-          @settings.merge(dsl)
-        end
-
-        def waf_debug=(arg)
-          dsl = AppSec::Configuration::DSL.new
-          dsl.waf_debug = arg
-          @settings.merge(dsl)
-        end
-
-        def trace_rate_limit=(arg)
-          dsl = AppSec::Configuration::DSL.new
-          dsl.trace_rate_limit = arg
-          @settings.merge(dsl)
-        end
-
-        def obfuscator_key_regex=(arg)
-          dsl = AppSec::Configuration::DSL.new
-          dsl.obfuscator_key_regex = arg
-          @settings.merge(dsl)
-        end
-
-        def obfuscator_value_regex=(arg)
-          dsl = AppSec::Configuration::DSL.new
-          dsl.obfuscator_value_regex = arg
-          @settings.merge(dsl)
-        end
-
-        # Reader methods
-
-        def enabled
-          @settings.enabled
-        end
-
-        def ruleset
-          @settings.ruleset
-        end
-
-        def ip_denylist
-          @settings.ip_denylist
-        end
-
-        def user_id_denylist
-          @settings.user_id_denylist
-        end
-
-        def waf_timeout
-          @settings.waf_timeout
-        end
-
-        def waf_debug
-          @settings.waf_debug
-        end
-
-        def trace_rate_limit
-          @settings.trace_rate_limit
-        end
-
-        def obfuscator_key_regex
-          @settings.obfuscator_key_regex
-        end
-
-        def obfuscator_value_regex
-          @settings.obfuscator_key_regex
-        end
-
-        def merge(arg)
-          @settings.merge(arg)
-        end
-
-        private
-
-        # Restore to original state, for testing only.
-        def reset!
-          @settings.send(:reset!)
-        end
+        Core::Configuration::Settings.extend(Configuration::Settings)
       end
     end
   end

data/lib/datadog/appsec/monitor/gateway/watcher.rb

@@ -24,7 +24,7 @@ module Datadog
                 scope = Datadog::AppSec.active_scope
 
                 AppSec::Reactive::Operation.new('identity.set_user') do |op|
-                  Monitor::Reactive::SetUser.subscribe(op, scope.processor_context) do |result, _block|
+                  Monitor::Reactive::SetUser.subscribe(op, scope.processor_context) do |result|
                     if result.status == :match
                       # TODO: should this hash be an Event instance instead?
                       event = {
@@ -44,10 +44,10 @@ module Datadog
                     end
                   end
 
-                  _result, block = Monitor::Reactive::SetUser.publish(op, user)
+                  block = Monitor::Reactive::SetUser.publish(op, user)
                 end
 
-                throw(Datadog::AppSec::Ext::INTERRUPT, [nil, [:block, event]]) if block
+                throw(Datadog::AppSec::Ext::INTERRUPT, [nil, [[:block, event]]]) if block
 
                 ret, res = stack.call(user)
 

data/lib/datadog/appsec/monitor/reactive/set_user.rb

@@ -29,7 +29,7 @@ module Datadog
                 'usr.id' => user_id,
               }
 
-              waf_timeout = Datadog::AppSec.settings.waf_timeout
+              waf_timeout = Datadog.configuration.appsec.waf_timeout
               result = waf_context.run(waf_args, waf_timeout)
 
               Datadog.logger.debug { "WAF TIMEOUT: #{result.inspect}" } if result.timeout
@@ -38,11 +38,8 @@ module Datadog
               when :match
                 Datadog.logger.debug { "WAF: #{result.inspect}" }
 
-                block = result.actions.include?('block')
-
-                yield [result, block]
-
-                throw(:block, [result, true]) if block
+                yield result
+                throw(:block, true) unless result.actions.empty?
               when :ok
                 Datadog.logger.debug { "WAF OK: #{result.inspect}" }
               when :invalid_call

data/lib/datadog/appsec/processor/actions.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    class Processor
+      # Actions store the actions information in memory
+      # Also, takes care of merging when RC send new information
+      module Actions
+        class << self
+          def actions
+            @actions ||= []
+          end
+
+          def fecth_configuration(action)
+            actions.find { |action_configuration| action_configuration['id'] == action }
+          end
+
+          def merge(actions_to_merge)
+            return if actions_to_merge.empty?
+
+            if actions.empty?
+              @actions = actions_to_merge
+            else
+              merged_actions = []
+              actions_dup = actions.dup
+
+              actions_to_merge.each do |new_action|
+                existing_action = actions_dup.find { |action| new_action['id'] == action['id'] }
+
+                # the old action is discard and the new kept
+                actions_dup.delete(existing_action) if existing_action
+                merged_actions << new_action
+              end
+
+              @actions = merged_actions.concat(actions_dup)
+            end
+          end
+
+          private
+
+          # Used in tests
+          def reset
+            @actions = []
+          end
+        end
+      end
+    end
+  end
+end